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INFORMATION COLLECTION ARCHITECTURE 
AND METHOD FOR A DATA COMMUNICATIONS 
NETWORK 

BACKGROUND OF THE INVENTION 

1. Technical Field 

The invention disclosed broadly relates to the extrac- 
tion of information from large bodies of data for high 
speed communication facilities. This invention is partic- 
ularly well suited to the extraction of information which 
characterizes complex data communications networks. 

2. Background Information 

With the advent of FDDI, BISDN, and SONET, the 
day of gigabit computer communications network is 
here, and the day of the terabit network is fast ap- 
proaching. These high speed network environments 
demand new and powerful tools that require informa- 
tion from the network to assist with network design, 
network management, network control functions, and 20 
network services. One extremely important problem to 
solve is how to monitor the raw data from one or more 
high speed communications channels and convert the 
data to useful ''information," for a user, a service, input 
to an algorithm whenever it is required, etc. Previously, 
tins problem has been viewed to be that of "real-time" 
network monitoring and performance evaluation. Net- 
work monitoring is defined as the extraction, process- 
ing, collection, and presentation of dynamic informa- 
tion with respect to the operation of a system. Monitor- 30 
ing information is then used by network performance 
management (usually an individual) to evaluate the state 
of network resources in real-time (usually via some type 
of display). Involvement by high skilled individuals, 
unfortunately, is required by the present day state-of- 
the-art. 

Data collection requires the accumulation of informa- 
tion relevant to its use. Two approaches for network 
data collection arc typically used: 

1. Tracing an recording the actual data. The term 40 
"trace" refers to a record of all frames and bytes 
transmitted on a network, as well as environmental 
information. Two examples of environmental in- 
formation include time stamps and . control block 
information! A trace usually provides a complete 45 
picture of time dependent network behavior. 

2. Collecting statistical information only. Statistical 
information is parametric information that is usable 
in mathematical models for performance evalua- 
tion. Unlike trace data that keeps track of all infor- 
mation transmitted and relative timing information, 
statistical information is obtained by categorizing 
the data and keeping counters for each category. 
For example, we could categorize frames by frame 
length and count the number of frames of a particu- 
lar length within a given time interval. Statistical 
approaches are not flexible and are typically geared 
to one particular usage (in the worst case just a user 
display). Statistical methods have well-known defi- 
ciencies and often loose part or all of the relevant 60 
information required (e.g. lb^~environmental infor- 
mation, timing references, activity dependencies). 
Statistics can alert you to the presence'bf a problem 
but all too often a trace is required for its diagnosis. 

Often, due to both the correlation of network activi- 
ties and the **time dependent" nature of some network 
functions and services, the only tool previously avail- 
able to capture all the required data was a trace, The 
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trace approach for collecting network data has tradi- 
tionally been accomplished via two methods: 

1. Direct trace of network activity through memory 
to disk storage (we are assuming that present hard- 
ware technology will allow data capture at the 
media rate). 

2. Preprocessing of trace data in memory so that only 
a subset of all the available network activity is 
written to disk storage. 

These methods capture network activity so that an 
"after the fact" analysis on the captured network data 
can be done to obtain performance information, such as 
a performance assessment. To illustrate the limitations 
of traditional methods, we provide the following exam- 
ples. Many consider that the data transfer rates 
(throughput) of existing networks bring performance 
analysis, performance monitoring, and performance 
problem determination techniques to their present tech- 
nological limit due to: 

1. Quantity of disk storage required. A 16 Mbit Token 
Ring could generate 2,000,000 bytes of data every 
second. A 600 Mbyte disk can be filled in 300 sec- 
onds (5 minutes). A 100 Mbit FDDI ring (just one- 
half of the dual FDDI ring) could generate 
12,500,000 bytes of data every second a 600 Mbyte 
disk can be filled in 48 seconds. 

2. Read/write access time limitations for disk storage. 
Typical read/write access time is in the millisecond 
range, where data for a 16 Mbps Token Ring ar- 
rives in the microsecond range and FDDI ap- 
proaches the nanosecond range today. 

3. Speed with which instructions can be processed. A 
100 byte packet could arrive from a 16 Mbit Token 
Ring every 50 microseconds. A 10 MIP processor 
would only have 500 instructions between packet 
arrivals in which to process each packet. A 100 
byte packet could arrive from a FDDI ring every 8 
microseconds. A 10 MIP processor would only 
have 80 instructions between packet arrivals in 
which to process each packet. 

The information extracted from a data communica- 
tions network can be used in many ways. A few exam- 
ples follow. 

1. Performance problem determination and analysis: 
collect actual frames and their time relationships. 
This means that statistical information is simply not 
enough. (Statistics often represent just another 
generic symptom of the problem.) 

2. Performance monitoring: collecting statistical in- 
formation and reporting the "appropriate** inter- 
vals. 

3. Benchmarking collects actual data but may use 
filters to gather only significant portions of this 
data. 

4^I?erformance*tunmg"' and optmiizanon:; collect ac- 
tual data^but may'u^filters to^gathef clly"sigjiif1^ 
ff caiitvpprtions -of ; this- data while*preservmg * time 
- *;<ier^deti<^^(Note\^^ 
grgws^Ui ning ^ 
enttechlSa^iesO 

5. Workload analysis and reporting: collect actual 
data or statistical data depending on specific re- 
quirements. 

6. Network sizing: collect actual data or statistical 
data depending on specific requirements. 

As network speeds increase, (e.g. FDDI, FDDI 1, 
SONET) it is becoming more apparent that traditional 
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data collection approaches will no longer be adequate. The invention is independent of communications 
The invention disclosed herein is designed to eliminate protocol and physical media. 

the necessity of tracing as a means of network informa- The Information Collection Architecture invention is 
tion capture. physically connected to an existing data communica- 
The advent of high speed media such as CSMA/CD, 5 tions network to monitor the high speed messages 
Token Ring, and FDDI, along with recursive envelop- which are transferred over the network. The Infonna- 
ing of multiple architectures, has brought considerable tion Collection Architecture invention includes a feed- 
complexity and has changed the very nature of net- back connection which can be used to provide control 
working. Basically, the world is evolving to an encapsu- signals back to the data communications network to 
lation oriented, any-to-any network, using any media 10 modify the behavior of the network in response to mon- 
and any protocol at any time in any environment We itoring data messages on the network, 
will refer to this environment as a KNA (Kluge Net- The Information Collection Architecture invention 
work Architecture) environment. Unlike older (and performs the functions of real-time identification of 
often proprietary) monolithic networks, heterogeneous events which occur on the network and prepares sum- 
multi-protocol and multi-vendor (KNA) networks do 15 maries of correlated event behavior for the network, 
not come bundled with all the necessary management The Information Collection Architecture invention 
functions for monitoring, controlling, and diagnosing provides correlated data and does not go through a 
network problems. The marketplace focuses on KNA decompression or reconstruction process. In this man- 
functionality. Thus, these environments lack an overall ner, the invention differs from the prior art technique of 
Information Collection Architecture and direction be- 20 data compression and sampling, 
cause of the multiple products and protocols they use, The Information Collection Architecture invention 
that are being invented and modified on a daily basis. performs an examination of only the frequency of oc- 
Information necessary to mange the environment is currence of selected bit patterns, unlike the prior art 
critical but constantly changing. In a KNA environ- trace techniques which require examination of all net- 
ment, only a totally flexible physical layer "tap," that is work data to determine performance metrics, 
independent of hardware and protocol changes makes The Information Collection Architecture invention 
sense. permits all traffic to be monitored so that no informa- 

OBJECTS OF THE INVEmiON ^^^^i^^T^ 
It is therefore an object of the invention to provide an work traffic to reach the network monitor for analysis, 
improved technique for extracting information from a The Information Collection Architecture invention 
large body of data. includes an organized collection of hybrid data reduc- 
It is another object of the invention to extract infor- tion vectors and their associated services. These ser- 
mation characterizing a high speed data communica- 35 vices include performance monitoring, performance cr V 
tions network. tuning and optimization^ benchmarking, problem deter- 
It is still another object of the invention to provide an minatimy workload analysis and reporting, network 
architecture and method for extracting information sizing, load balancing, load distribution, network con- 
from a variety of high speed data communications net- trol, network accounting and network management 
works. 40 functions. These services are provided for a large van- 
It is still a further object of the invention to provide a ety of data communications networks, 
method and architecture for extracting physical infor- __________ _____ ________ 

mation about a complex data communications network. DESCRIPTION OF THE FIGURES 

It is yet a further object of the invention to provide a These and other objects, features and advantages will 

method and architecture for extracting information 45 be more fully appreciate with reference to the accompa- 

about the logical activity of a complex data communica- nying figures. 

tions network. FIG. 1 control and data flow diagram of the Informa- 

It is still a further object of the invention to provide tion Collection Architecture invention, 

an architecture and method for applying a real-time FIG. IB is an architectural diagram of the Informa- 

feedback control to the logical or physical network 50 tion Collection Architecture invention, employing in- 

behavior of a complex data communications network. band control. 

SUMMARY OF THE INVENTION {S^'^dXV^SSISLSL. 

These and other objects, features and advantages are ory 132 and its interaction with the address bit register 

accomplished by the invention. The invention is an 55 134 in the Event Driven Interface 120. 

Information Collection Architecture (ICA) which in- FIG. 3 is a diagram of a filter pattern tree structure 

chides both the method of operation and the hardware for the Event Driven Interface, 

components. The Information Collection Architecture FIG. 4 is a sequence chart for the values in the 14-bit 

invention extracts information characterizing all data address register 134 and the filter RAM output at the 

communications network environments, especially 60 specified bit times for the Event Driven Interface, 

those that are high speed and/or complex network FIG. 5 illustrates the filter memory 132 -with three 

environments. output bits on line 144 for the Event Driven Interface. 

- The Information Collection Architecture invention is FIG. 6 is a generalized organizational diagram of the 

an enabler that provides a unique physical layer based Information Collection Architecture invention, 

window into both physical and logical network activ- 65 FIG. 7 is a generalized fl w diagram of the Informa- 

ity. The application of the invention can significantly tion Collection Architecture process, 

improve the functions, and services and management of FIG. 8 is a schematic diagram of the programmable 

any data communications network. performance vector generator 121. 



- *- 
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FIG. 9 is a conceptual diagram of the logical tree tored by EDI 120B. Network 128 is monitored by EDI 
structure established in the Event Driven Interface 120. 120C. Network 130 is monitored by EDI 120D. 

FIG. 10 shows a flow diagram of the method for the The architectural diagram of FIG. 1A further shows 
Information Collection Architecture invention. a data processor 105 consisting of a CPU 20, a memory 

DISCUSSION OF THE PREFERRED 5 100 ' a / ctwork m0 ^> r 22 '/ 'outer ^erface 24 con- 

EMBODIMENT nected to the router 115, and a printer 26. The memory 

100 stores programs consisting of a sequence of execut- 

The Information Collection Architecture invention is able instructions, to perform desired functions when the 
shown in a functional block diagram in FIG. 1A which instructions are executed in the CPU 20. Programs that 
illustrates the control and data flow organization for the 10 are included in the memory 100 include the media man- 
invention. There are three network sender nodes Al, ager 102, the control vector generator 104, the routing 
A2 and A3 which are connected through the router 115 expert 106, the performance expert 108, the security 
to each of four different types of networks, a Token expert 110 and the monitoring expert 112. The control 
Ring Local Area Network 124, a Fiber Distributed vector generator 104 can be a part of the routing expert 
Data Interface 126, an Asynchronous ATM network 15 106. The control generator 104 can be a data file, in one 
128, and an Ethernet network 130. Each of these four embodiment, which stores predefined control vectors 
networks 124, 126, 128 and 130 are respectively con- to be downloaded to the EDI 120A. In another embo di- 
rected to a second router 140 which then connects to ment, the control vector generator 104 can be a se- 
the three destination nodes Bl, B2 and B3. The router quence of program instructions to perform the filter 
115 uses the routing table contained therein to establish 20 pattern consolidation method shown in the e xamp le 
a logical and/ or physical connection between one of the below. The Information Collection Architecture inven- 
senders Al, A2 or A3 and one of the destinations Bl, B2 tion includes the control vector generator 104 to access 
or B3. The routing table shown in FIG. 1A illustrates or to generate an appropriate pattern of control vectors 
that the source Al is connected to the destination Bl C(i) for each respective network 124, 126, 128 and 130 
over the path P2 which is the FDDI network 126. The 25 which is to be monitored by a corresponding Event 
routing table further provides an interconnection be- Driven Interface 120 A, 120B, 120C or 120D. The con- 
tween sender A2 and the destination B2 over the path trol vectors C(i) on line 142, are loaded into the Event 
PI which is the Token Ring LAN TRLAN 124. The Driven Interface 120A, to configure the Event Driven 
routing table shown in FIG. 1A also establishes the Interface 120A to appropriately detect corresponding 
connection between the source A3 and the destination 30 bit patterns for frames, tokens and other message and 
B3 over the path P4 which is the Ethernet network 130. control sequences transmitted on the Token Ring LAN 
Network 124 includes nodes Nl to N6 controlled by 124. In accordance with the invention, the Event 
manager 122A. Network 126 includes nodes N7 to N12 Driven Interface 120A will then output event vectors 
controlled by manager 122B. Network 128 includes E® on line 144 which are received by the data proces- 
node N13 controlled by manager 122C. Network 130 35 sor 105 for analysis by the appropriate expert program, 
includes nodes N14 to N17 controlled by manager In this example, the routing expert 106 will perform an 
122D. analysis of the event vectors E(i) to provide control 

Occasionally, bottlenecks, or other communications information which is output on line 146 to the manager 
events occur on a particular network, such as the Token node 122A of the Token Ring LAN 124. Alternately, 
Ring LAN 124, which make the selection of that net- 40 the routing expert 106 will output routing control infor- 
work less than optimum path for the transmission of mation through the router interface 124 to the router 
information from the sender A2 to the destination B2. In 115, to modify the routing table shown in FIG. 1A. 
accordance with the invention, the Information Collec- Corresponding operations can be performed with the 
tion Architecture invention includes the Event Driven Event Driven Interface 120B and the manager node 
Interface (EDI) 120A, that is described in greater detail 45 122B for the FDDI network 126 shown in FIG. 1A. 
in FIGS. 2A-5, that is connected to the Token Ring S imilar operations can be performed with the EDI 
LAN 124. The Event Driven Interface 120A has been 120C and the manager node 122C for the ATM net- 
configured by appropriate control vectors CO) received work 128. Correspondingly similar operations can be 
over the line 142, to perform a customized monitoring performed with the EDI 120D and the manager node 
of the characteristics of the Token Ring LAN 124. The 50 122D for the Ethernet network 130. 
Event Driven Interface 120 A outputs event vectors E(i) Reference to FIG. 6 shows an overall organizational 
on line 144 that eventually arc used to control the router diagram of the Information Collection Architecture 
115. The router 115, in response, will revise its routing which illustrates that it is comprised of an expert system 
table so as to connect the sender A2 to the destination such as the routing expert 106, and the programmable 
B2 over a different network providing a more optimal 55 performance vector generator 121. The programmable 
communication than that currently provided by the performance vector generator 121 is an I/O card shown 
Token Ring LAN 124. schematically in FIG. 8 , which includes the Event 

In an alternate mode of control, the manager node Driven Interface 120 connected through a network 
122A shown in FIG. 1A, which is connected to the interface 136 such as a Token Ring interface, to the 
Token Ring LAN 124, can receive control information 60 Token Ring 124. FIG. 8 also shows the Event Driven 
over line 146 in response to the event vectors E(i) out- Interface 120, receiving control vectors C(i) through 
put on line 144 from the Event Driven Interface 120 A, the microchannel interface circuitry 138 and delivering 
to modify the traffic produced by one or more nodes event vectors E(i) to the microchannel interface cir- 
and three on the Token Ring LAN 124, to alleviate the cuitry 138. The programmable performance vector 
bottleneck condition on the Token Ring LAN 124, 65 generator card 121 will plug into a workstation such as 
thereby enabling the sender A2 to communicate with an IBM Personal Systems/2, upon which may be resi- 
the destination B2 in a more efficient manner. Network dent a memory for storing appropriate control vectors 
124 is monitored by EDI 120 A. Network 126 is moni- CQ. The workstation may also store the control vector 
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generator 104 and a routing expert 106 to enable a self- time as a digital filter which is a versatile, reprogramma- 
contained Information Collection Architecture invcn- ble low cost digital filter capable of multiple outputs, 
tion connected to an individual network, such as the The filter handles multi-megabit sustained data ratesj 
Token Ring LAN 124. and performs real time filtering of the incoming data 
Reference now to FIG. IB shows the Information 5 based on multiple patterns which are user definable. 
Collection Architecture invention which was ill us- The digital filter technique is significant because the 
trated and discussed in FIG. 1A, in an alternate and architectural concepts of the filtering process applied to 
preferred embodiment which employs inband control areas where fast real-time digital filtering is required, 
with all communication being carried out through the The EDI is a state-machine which implements a real- 
respective networks 124, 126, 128 and/or 130. In order 10 time filter built with a few memory modules, a register 
to accomplish this, the programmable performance and clock circuitry. It is programmed by expert 106, 
vector generator (PPVG) card 121, coupled to an ap- which generates the input to the state-machine, 
propriate workstation, is connected to its corresponding The EDI 120 digital filter is a state machine which is 
network, such as the PPVG card 121A, is connected at built with off-the-shelf components and is configured 
node N6 to the Token Ring LAN 124. Similarly, the 15 with computer program methods to create the states of 
PPRG card 121B is connected to the node N12 of the the state machine. The EDI 120 compares the incoming 
FDDI network 126. Correspondingly, the PPVG card data from LAN 124, for example, with user defined 
121C is connected to the ATM network 12$. The filter patterns (real time) and if the incoming data 
PPVG card 121D is connected to the Ethernet network matches the user defined filter pattern(s), external out- 
130. In this alternate embodiment of the invention, ref- 20 put lines 144 are activated. These lines output the event 
erence can be made to FIG. 6, which describes the count vectors E(i) or they can be used to cause the 
expert system 106 sending the control vector O® to the storage of the incoming data, the triggering of other 
programmable performance vector generator 121 to devices, the synchronization of external devices, etc. A 
configure the Event Driven Interface 120 A to collect counter 170 can be incremented each time a successful 
specified performance parameters for the specified net- 25 match is made. Several types of patterns can be counted 
work protocol, in this case the Token Ring LAN 124. in a corresponding number of counters 170 (see FIG. 9). 
In response to the monitoring operation performed by The accumulated counts will then be the vector E(i). In 
the EDI 120A, the PPVG 121A will return event vec- addition, the filter can be placed in a mode where the 
tors E(i), that contain these performance parameters. external output lines 144 are activated when the incom- 
Then the expert system 106 will use these parameters to 30 ing data does not match one of the user defined filter 
computer the desired network performance matrix and patterns. The number of filter patterns that can be speci- 
men compare these matrices with those for optimal fied is dependent on the amount of filter memory imple- 
perfonnance. If poor performance is determined, the mented. 

expert system can take remedial action, such as output- The EDI digital filter hardware is composed of two 

ting a control signal over line 146 to the manager node 35 elements: a RAM 132 and an address register 134 for the 

122A, to modify the traffic pattern on the Token Ring RAM, see FIG. 2A. The address register is 'N* bits 

LAN 124. Alternately, the expert system 106 can output wide. The most significant bits of the next address of the 

router control information through the router interface RAM to be accessed are contained in the N-l least 

24 to the router 115, to alter the path over which com- significant bits of the RAM. Any remaining RAM bits 

munications are being conducted between a sender 40 can be used as external outputs from the filter (i.e. one 

node such as A2, and a destination node such as B2. bit is used to indicate if the incoming data matches one 

FIG. 7 shows a high level flow diagram of the of the filter patterns), 
method of operation for the Information Collection 

Architecture. The expert program, such as the routing Filter Operation 

expert 106, will store optimal behavior which would be 45 The address register 134 is set to zero to start the filter 

expected for a particular communications network such process. When the EDI filter process is started, the 

as the Token Ring LAN 124, in the information 150 of address register is loaded with N-l bits of output from 

FIG. 7. The performance measurement process carried RAM location zero and one bit of mcorning data. The 

out by the Event Driven Interface 120 A, in the PPVG mcorning data bit becomes the low order bit in the 

121 A, provides the event vectors E0 in 152 of FIG. 7. 50 address register. These bits (the N-l bits of the RAM 

The optimal behavior information 150 is then compared output and the incoming data bit) combine to form the 

with tie performance process information 152, by the N bit address in the address register to be used for the 

analysis and comparison function 154 of FIG. 7. This is next 4f READ" of the RAM 132. When the "READ" 

done in conjunction with the knowledge base 156 occurs, N-l bits of the output from the RAM and the 

which will provide a sequence of "IF," "THEN," 55 incoming data bit are loaded into the address register 

"ELSE" statements which test and compare the perfor- and the process continues until the filter is halted. If the 

mance measurement process information E® in 152 mcorning data matches one of the filter patterns the 

with the optimal behavior information in 150. The dif- filter "loops" at a RAM location with one of the exter- 

ference between a performance measurement process nal output lines activated (to indicate that the mcorning 

information 152 and the optimal behavior information 60 data matched one of the filter patterns). This RAM 

150 is output at 158 as control information which can be location is called the "Infinite Good Loop" (IGL). A 

applied to either the router 115 or the manager node at separate infinite good loop (IGL) is provided for each 

122A in FIG. 1A or to the PPVG card 121A and the distinct pattern for which a count is to be accumulated, 

manager node 122A in FIG. IB. When an IGL for a particular pattern is reached, the 

The Event Driven Interface (EDI) 65 ™*<^»^& ™ is mcremented and the con- 

v ' tents of the address register 134 is reset to zero. The 

The Event Driven Interface (EDI) digital filter 120, contents of the counter 170 becomes part of the event 

shown in FIG. 2A hereinafter referred to from time to vector E© output by the EDI 120A If the incoming 
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data did not match one of the filter patterns, the filter At every bit time, the incoming data bit is placed in 

"loops" at a RAM location with an external output line the N (14) bit address register with N— 1 (13) bits of 

not activated. This RAM location is called the "Infinite feedback address from the filter memory. This N (14) 

Bad Loop" (IBL). bit address determines the next N- 1 (13) bits of feed- 

This process is illustrated in FIG. 2B. (In the illustra- 5 back address to be used at the next bit time, this is illus- 

tion the address register is 14 bits wide (N=14). The trated in FIG. 4. The example received data given in 

values for the 13 (N-l) least significant bits are shown in FIG. 4 is Patternl in FIG. 3 and is contained in the 

the filter memory 132. Note: The 13-feed-back bits are example memory given in FIG. 2B. A method of inter- 

eifectively multiplied by 2 because they are placed in preting the hex numbers under the branches in FIG. 3 is 

the bit positions 2-4 in the address register. The least 10 the following: If the N (14) bit address register contains 

significant bit is the right-most bit, the most significant XTO02' (two times the hex value of V0OV given under 

bit is the left-most bit, see FIG. 4.) For illustration pur- the first branch) and the incoming data bit (bit 1) is a 

pos es th e cont ents o f RAM location X'3FFC and B'O', the feedback value will be X*0002\ Ifthemcoming 

X € 3FFD' are X'IFFE\ Thus, if a BT or a B'O' is re- data Wt (bit 1) is a BT, the feedback value will be 

ceived as the incoming data (this bit becomes the least 15 X*0003\ 

significant bit in the 14 bit address register), the 13 bit p T t*m*i rw„„* t 

part of the address that is fed back is always X'iFFE'. Extemal ° UtpUt ^ 

Thi s cau ses the filter to loop at location X*3FFC and 1x1 addition t0 the N-l bit output which is fed back 

X'3FFD' until halted. This is referred to as the "Infinite t0 ^ N bit addre ss register 134 in the digital filter, the 

Bad Loop" (IBL) location. The contents of RAM loca- 20 RAM 132 *b° outputs other bits on line 144. These bits 

tionX*3FFA , andX3FFB'areXlFFD , .Thus,ifaBT can S° to data processor 105 as the event 

or a B 4 0' is received as the incoming data (this bit be- counts E ®' ° r bits on ^ 144 WG. 2A can be 

comes the least significant bit in the 14 bit address regis- from 311 ^dividual IGL location in RAM 132, to be 

ter), the N-l (13) bit part of the address that is fed back counted in a corresponding individual counter 170, as in 

is always X1FFD\ This causes the filter to loop at 25 FIG ' 9 > t0 0011111 occurrence of a corresponding 

location X'3FFA' and X*3FFB* until halted. This is P attern * ° r can be used to control the storage 

referred to as the "Infinite Good Loop" (IGL) location of tnce ***** synchronize other devices, increment 

A separate IGL location is provided for every pattern ST^ifSi^ ^^^TV^t^j) ° f the 

on the network to be counted in one of the counters 170 , A filter RAM 132 are fed back to the N bit address register 

30 134, the user can specify the value of additional output 

Filter Pattern Creation bits (external output lines 144) on a bit-by-bit basis in the 

The control vector generation function 104 of the P^*^™? b aha ^ d ™ mG 5 « N ° te that 

routing expert 106, creates a set of filter patterns using ™, n SpeClfied eXX * m * ° UtpUt 

the 'TaterPattern Consolidation Method" featured 35 ^^^'Jt TT^ 

this invention, described below. Because ALL filter 35 £jf to ^ of P attero 3 15 observed m incoming 
patterns are compared on a real time basis, they are 

combined into a consolidated filter pattern (which com- Filter Pattern Consolidation Method 

bines all of the individual filter patterns into one pat- A n „r u,- cn ^ „ w ^ • * 

tern). This consolidation can be thought of as a free m «J£jL t? ^ T f I COmbmed °* e f?" 

structure with branching from the nixies f pattern usmg the following method, which is 

, _ . * . , , uwra uwwu i earned out by the control vector generation function 

when anmcon^gdata bit is placed in the N bit address 104 of ^ n 106 ^ h %it in all patted 

branching ^determined by consolidated shrml^eously, Le. bit one of Tvery pat- 

„f ( * fi^fi ~?£ 3 tere 58 consolidated, then bit two, etc. The foUowbg 

the consohdauon of the first five bits of four filter pat- 4S tenns md variables ^ wed to mustrate m prodes* 

tt^&lfSSZE^JE^X A tob,e of ,<COTCnt Active Memory Locations" 

^™t^™lf,fl^f A> f0l_ (CAML): This table contains the locations in the 

^Hllfi' ,1, niter memory that the pattern currently exists for 

2 represents a node in the filter pattern tree each pattern for that bit time. 

s^^^odes^^d^si^pomtsmthetx^ x A variable which contains the "Next Available Mem- 

The dec^on to take die left path (branch) occurs if ory Location" (NAML). This variable is always 

die next mconmg bit is B-O- and the right path incremented by two. 

(branch) rf taken tf the next mcoming bit is a BT. A variable which contains the current value of 

^^hexnumbmunderthebranchesarethevaluesof NAML, NAML_CURRENT. 

the N-l (13) bite which are fed back from the filter 55 A control block (CB) is constructed for each bit in 

memory to the N (14) bit address register shown previ- each pattern which contains the following informa- 

ously. In the address register, these feedback values are n on: 

effectively multiplied by two because the least signifi- pattern number 

cant bit of the N (14) bit address register is the incoming value of the filter bit (B'O' or F1-) 

da il blt ;„^ T „ . « current active memory locations) — CAML 

The IGL indicates the location of an "Infinite next memory location to be used by the pattern(- " 

Good Loop" in the filter which is used when the incom- . s)— NAML — 

ing data is determined to match one of the filter pat- a "Reset Location" for the filter. This is illustrated at 

tC ^' ...or ,, . j. , , . , XD000' and X'OOOr but could exist at other loca- 

The IBL" indicates the location of an "Infinite Bad 65 tions. 

Loop" in the filter which is used when the incom- An "Infinite Good Loop" (IGL) location where the 

mg data is determined not to match any of the filter hardware loops when the incoming date is found to 

patterns. match one of the filter patterns. This is illustrated at 
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X'3FFA* and X 4 3FFB' but could exist at other the one-half of the value contained in the NAML 

locations. A separate IGL is provided for every field of the CB. 

distinct pattern to be counted. 9. All memory locations less that NAML_CUR- 

An "Infinite Bad Loop" (IBL) location where the RENT which were not written to in step 7 or 8 are 

hardware loops when the incoming data is found 5 written with the IBL location, 

not to match one of the filter patterns. This is ill us- 10. All CBs are erased 

trated at X'3FFC and X'3FFD* but could exist at 11. The process loops back to step 3 and continues 

other locations. until all bits of all patterns have been processed. 

The following method is performed by expert 106 to 12. The lines of data stored in the locations of the 

consolidate the filter patterns and is illustrated in the 10 filter memory RAM 132 of FIG. 5, are the control 

example following the method. vectors C(i) constructed by the expert 106. 

1. The CAML table is set to two for all patterns. T . ^ 
NAML is set to four, (location zero is used to reset Implementation Observations 

the filter machine). If an output bit is set when the hardware loops at the 

2. The "Reset Location" (X'0000* in the example) is 15 IBL location, all patterns not in the filter pattern would 
written with the one-half of the value of the loca- be detected 

tion of the start of the filter patterns in the RAM The use of feedback from the digital filter to the 
(X*000r in the example). The "Infinite Good circuit controlling the digital filter could be used to 
Loop" (IGL) location is written (X*3FFA' and create very complicated filtering processes with simple 
X*3FEB' in the example). A separate IGL location 20 combinational logic. Some examples include: 
is provided for each filter pattern to be individually After a "filter pattern" or one of a set of "filter pat- 
counted by counters 170. The "Infinite Bad Loop" terns" or a sequence of "filter patterns" has been 
(IBL) location is written (X'SFFC and X*3FFD' in observed in the serial data stream, then begin ob- 
the example). serving the serial data stream for other filter pat- 

3. A Control Block (CB) is created for each bit of all 25 ten3S - 

the patterns (in the example CBs are created for bit After a "filter pattern" or one of a set of "filter pat- 
one of pattern t, 2, 3 and 4, then bit two of pattern terns" or a sequence of "filter patterns" has been 
1, 2, 3 and 4, etc.) for each value in the CAML observed in the serial data stream, then stop the 
table. filter fr° m observing the data stream. 
If an individual filter pattern has not ended: A CB 30 Parallel (bus type) data can be observed for patterns 

is built for the pattern which contains four fields: b ? serializing the data or by using multiple filters in 

pattern number— values of the filter bit— CAM- parallel. 

L — next memory location (NAML) to be used ^ extemal output Hues 144 allow virtually unlim- 

by the pattern. Two CBs are built (filter bit=- « ited out P ut for event counts E ®> synchronization of 

B'O' and filter brt=B'lO if the filter pattern bit is devices, for incrementing counters, etc. 

a "don't care." The maximum filter rate is constrained only by the 

If an individual filter pattern ends at this bit time: A memory access times, 

jump to the corresponding individual IGL loca- Under expert 106 control, the filter selects data from 

tion is required. A CB is built for the pattern ^ a multi-megabit serial data stream. Some examples in- 

which contains the four fields: pattern num- elude: 
ber— values of the filter bit— CAMI^-next 

memory location (NAML) to be used by the Filtering data streams for disk heads, 

pattern. The NAML field is assigned the value of Petering streams for modems. 

the memory location of the corresponding indi- 45 ra tering data streams for TP lines. _ 

vidua! IGL. Two CBs are built (filter bit=B*0' Filtering data streams for 3274 to 3278/79 communica- 

and filter bit=BT) if the filter pattern bit is a * ons ' a „ „ 

"don't care." Filtering data streams for SDLC communications. 

If an individual filter pattern has ended no CBs are Petering streams for SNA communications, 

built. 5Q Filtering RS232 data streams. 

4. If multiple CBs have equal values of the filter bit filtering LAN traffic (Ethernet, Hyperbus, IBM- 
and the CAML, then the CBs are combined, Le. the ^ okcn 

combined CBs now have multiple pattern numbers. ^Jtenng text (by digitizing and serializing it). 

5. If multiple CBs have equal pattern numbers and ^ tomg c *J annel 

equal values of the filter bit, the CBs are combined, 55 "T** 6 tdeptaoae P* 1 ** 

Le. the combined CBs now have multiple CAML. ratcnn g P™^ 

6. The value of the current NAML is stored (NAM- TABLE 1 

L-.CURKENT) and the NAML is assigned to EXAMPLE filter 

each CB that was not assigned in step 3 (the IGL CONSOLIDATION METHOD BY expert 106 

location) and the CAML table is updated with the 60 NOTES: 

NAMLs which were assigned to each CB. •AD values arc in hex 

7. For each CB whose filter bit value equals zero, the * N = 14 register is 14 bits), 
memory location contained in the CAML field of ^ 'Z^V^m™'' 
the CB is written with the one-half of the value ♦The ibl = X3FPC and X*3FFD*. 
contained in the NAML field of the CB. 65 *Output bits are not illustrated. 

8. For each CB whose filter bit value equals one, the *Hiicr Patterns: 
memory location contained in the CAML field of Parteml = B*oof" : 
the CB is incremented by one and is written with Pattern3 » b<X1V 
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Application of the Information Collection Architecture 45 
Invention 

The expert system 106 characterizes the parameters 
for each of a variety of network protocols, for example 
Token Rmg/Btbernetr Fiber Data Distributed Inter- 
face, System Network Arcmtecture^TC^/IPi SONET, 
or BISDN, for example. The expert system 106 has an 
analysis portion which performs the analysis on the 
correlated event behavior, as will be described below. 
Also included is a control section which uses the results 
of the analysis performed on the correlated event be- 55 
havior of a network, to output control signals back to 
the network to control its behavior. 

FIG. 7 is a generalized flow diagram of the data 
analysis process for the Information Collection Archi- 
tecture invention. It is carried out by the analysis por- 
tion of the expert 106. 

The human activity involved in correcting the behav- 
ior of "anything" (often referred to as: problem deter- 
mination, problem resolution, performance analysis, 
tuning, design changes, . . . etc.) is a four step process 
where the successful completion of each step is abso- 
lutely fundamental to die success of the activity. The 



60 



65 



logical flow of this performance process is shown in 

FIG. 7. The steps involved are: 
Knowledge 156 — Accurate knowledge of the ex- 
pected behavior of the device, software, or envi- 
ronment that is being investigated. This knowledge 
is usually acquired from documentation and experi- 
ence. Documentation (because of product specifi- 
cations) is often imprecise, inconsistent, unau- 
thoritative, incomplete, and subject to question and 
change. Documentation is often misleading. Thus, 
the determination that a problem even exists can be 
equally imprecise, incomplete and subject to de- 
bate. (The previous specification and documenta- 
tion problems arc very well-known in fault toler- 
ance literature.) Accurate experienced based 
knowledge is required. This knowledge is often 
carried around in an "expert's" head. The expert, 
however, must have some analytical skill in apply- 
ing the knowledge. 
Current behavior 152 — A complete understanding of 
the current behavior of the environment (device or 
software). This is done by acquiring information 
through some process that collects the appropriate 
data. That process is represented at 152 of FIG. 7. 
Environmental factors usually impact behavior and 
all environmental dependencies must be captured 
in order to have a total picture of current (device 
or software) activity. Collecting network behavior 
is the focus of most network management hard- 
ware, software and LAN analyzers. They usually 
provide either mountains of traffic flow or ques- 
tionable statistics. Current network management 
products do not have the knowledge, nor the un- 
derstanding of correct behavior, nor the analysis 
ability to interpret any data they collect. 
Correct (or optimal behavior) 150 — A complete un- 
derstanding of what constitutes correct or valid 
behavior of the device, software, or environment 
that is being investigated. This is a key require- 
ment. This step allows one to generate a "yard- 
stick" of acceptable behavior. Without this yard- 
stick one cannot tell the difference between normal 
and abnormal behavior. Experienced problem res- 
olution specialists will tell you the correct behavior 
of "anything" is a function of= its environment. 
Thus numerous environmental factors may need to 
be captured and considered. They can greatly im- 
pact yardstick calculations and overall accuracy. 
Analysis 154 — Analysis of current vs. optimal behav- 
ior. This is necessary in order to find the difference 
between current behavior and optimal behavior 
and to apply the appropriate knowledge to develop 
the problem description and recommendation for 
correcting (or improving) current behavior. It is 
key that the analysis technique be able to evaluate 
the difference in the context of the actual network 
environment. 

Control 158— Modify the behavior of the device or 
network to conform to expected criteria. 

To further clarify the analysis process and demon- 
strate how fundamental it is to understanding and cor- 
recting the behavior of human inventions, we will apply 
it to toaster repair. First, a significant amount of knowl- 
edge of toasters can be accumulated through experience 
with toasters and/or reading (from the the Time-Life 
toaster repair series, for example). Once the knowledge 
(and hopefully some experience) is accumulated we can 
"hang out our toaster repair shingle" and wait for cus- 
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tomers. When a customer brings, what he thinks is, a planning or accounting programs because much larger 
defective toaster into our shop, we begin by assessing time frames are desired, 

the operational performance of the toaster. We insert a The speed with which data can be processed, i.e., 
piece of bread. We find it only toasts one side of the collected and analyzed affects the choice of time inter- 
bread (current behavior). We may (wrongly) conclude 5 val. For example, suppose that a network traffic collec- 
that the toaster is operating normally, and the bread tion and analysis technique could process a maximum of 
must be turned around and reinserted. A "two pass" 16 megabits of data per second. For a 16 MBPS Token 
toaster, if you will. In this case, we claim a "user error." Ring network, the processing of all available data could 
What is missing is complete understanding of what be accomplished using a one second time interval. How- 
constitutes correct toaster behavior. Without this infor- 10 ever, suppose that we wish to collect and analyze all 
mational "yardstick," we simply are unable to deter- data available for a terabit network. Assume that the 
mine if any observed behavior is normal or abnormal. data collection technique could keep up with the net- 
Sometimes the customer will provide the missing yard- work speed but that the analysis technique speed re- 
stick of correct behavioral information (and make us mained at 16 MBPS. Then the analysis would require a 
look incompetent in the process). This, however, is not 15 time interval of (1012/(16* l0 6 /sec))= 62500 sec=17 
likely to occur in a complex network environment be- hours and 21 minutes. If we wish to keep the processing 
cause neither you nor your client will have sufficient time interval the same for both networks, then we must 
understanding or time to generate the yardstick your- increase the speed with which to analyze the data or use 
selves. Typically some kind of expert information is a new technique. 

required. For example, a phone call to a boaster hot 20 The programmable performance vector generator 
line." Once a yardstick is developed a simple analysis 121 is shown in greater detail in FIG. 8. The PPVG 
consists of a comparison of actual vs. optimal behavior. card 121 is designed to see all physical media activity. It 
The difference is where we apply our acquired know!- is not blinded by chip set, hardware, or software limita- 
cdge and experience to effect a repair. The difference in tions. Information capture is accomplished by program- 
our toaster example is that the bread is not brown on 25 m™ g the Event Driven Interface 120 to recognize and 
one (the right) side. Thus, any truly useful analysis collect events at media speed. Finally, the events them- 
tool/program/methodology must deal with all four selves are organized in a way that is most useful for the 
steps of this analysis process. Analysis success is only service requesting the information. The real key is: do 
met when all four steps of the analysis process have not attempt raw data collection (with all its problems), 
been successfully completed and "answers" are pro- 30 Information Collection Architecture (ICA) invention 
vided in the form of specific recommendations of what concepts arc demonstrated for a 16 MBPS Token Ring 
t0 do. network. ICA is composed of two parts, an expert sys- 

We view the information collection problem from a tern 106 (or a service program of some nature) and the 
new perspective, i.e., as a two component problem: a ICA hardware device, the Programmable Performance 
"real-time" component that is hardware technology 35 Vector Generator (PPVG 121) of FIG. 8. 
dependent and a "variable-time" component that is - One or more expert systems 106 can send input con- 
network function and service dependent. trol vectors, C(i), to the PPVG card 121 to configure it 

The PPVG 121 Real-Time Monitor handles the real- to collect "events about specific network activities (e.g. 
time component problem. This monitor must make sure protocol behavior). The PPVG card will return event 
that no "required information" is lost Thus, the PPVG 40 vectors, ECO, that contain information concerning these 
121 must be able to inspect all data available on the events. The expert system 106 will convert these event 
communications link, no matter how fast it is sent. This vectors E® to states of a Fm ite State Machine ( FSM). 
component is hardware technology dependent The FSM flow allows tfiTcomputation of the o^ire"d 

The Programmable Real-Time Variable-Time Inter- network performance measures and then, compare 
face (PRVI) is a programmable hardware device that 45 these measures with those for optimal pe rfoxmance. If a 
screens the real-time data for only that portion of the performance problem is determine*!, theexperTsystem 
data required by the network function or service. The 106 can "suggest a remedy, present monitored data or 
PRVI also collects screened data, called "mformation," control a network control node, 
for the Variable-Time Reporter. The type of informa- Many who work in the high speed networking area 
tion collected by the PRVI may be changed "on line" 50 recognize that as network speeds increase, so must the 
through a programming interface. speed with which to collect and/or analysis information 

The Variable-Time Reporter sends the "proper time for network functions and services. This requirement 
framed information" to the requesting network function pushes information processing implementation to the 
or service for performance evaluation, problem deter- integrated circuit level which forces a significant trade- 
mination, monitoring activities, accounting activities, . . 55 off between speed and flexibility. The price to pay for 
. etc. This information must be sent on demand, but it extra speed and performance is typically a specialized 
need not be sent in real-time because most network hardware device that is inflexible when compared with 
functions, like performance evaluation, are typically not a software implementation. However, this trade-off is 
done in real-time. The time frame in which to report the not necessary for the ICA approach due to the pro- 
desired information to the network function or service 60 grammabuity of the PPVG card, 
depends on what that function or service will do with The PPVG card consists of three main parts: the 
the information. For example, decisions dealing with Event Driven Interface (EDI) 120, the network inter- 
load distribution, load balancing or other dynamic net- face (NI) 136, and microchannel or ES A interface (MI) 
work activity may require information on a second-by- 138 shown in FIG. 8. The event driven detector is the 
second basis to adequately control the network. It could 65 heart of the PPVG card. The EDI 120 relies on being 
be disastrous for network behavior to only update this programmed by the expert 106 to identify the proper 
information on a hourly basis. Second-by-sccond infor- bits that represent an event of interest. The EDI 120 
mation, however, is of little or no value to capacity will monitor only those network environmental charac- 
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teristics that are specified by the control vectors C(i) 
doing the programming of the EDI gate array. Con- 
sider a token ring utilization example, the EDI will 
count the number of free tokens to determine utilization 
and device transmission opportunity. This number is 5 
easily countable with today's technology. 

The expert system program 106 supplies input vec- 
tors C(i), to identify the events for which we seek infor- 
mation. For example, events could be Token Ring 
MAC frames, Ethernet collisions, FDDI tokens, ... etc. 10 
One possible C(i) vector could be: 

C(i)=(PCon f Num Evcnti. . . etc) 

where: 15 

Peon = Parameter Configuration, i.e. which ring bits 
we wish to count 

Num = Number of Events 

Eventi =ith Bit Pattern Information 

A tree method is employed to detect the appropriate 20 
events in the EDI, as shown in FIG. 9. Once the appro- 
priate network activity is identified by the CO) vector, a 
tree is configured within the EDI 120. Each branch of 
the tree corresponds to a unique pattern of bits (an 
event), say a token arrival event At the bottom of the 25 
tree are buckets, i.e. counters 170, that contain counts 
for the number of occurrences of these patterns. Thus 
an arbitrary event can be detected as well as its fre- 
quency (or severity). The number of buckets is deter- 
mined by the C(i) vector. These results permit us to take 30 
advantage of the fact that performance measures, such 
as utilization, throughput, and delay, can be derived by 
monitoring a small selection of bits from the channel. 
The outputs of these buckets are counts or comparison 
circuit outputs that will be returned to 35 
106 in the form of output vectors, E©s. Again for 
Token Ring environments, a possible E(i) vector would 
be: 

E(i)=(#T, #F, Mm F, EPR, AR4 ? Q#MAQ 40 
where: 

#T= Number of free tokens 
#F= Number of frames 

Max F=Max Frame Size 45 

Min F=Min Frame Size 

FPR=Max number of frames per token rotation 

AR = Complement of address recognized bit 

FC= Complement of Frame Copied Bit 

#MAC=Number of MAC frames 50 

These bit count and/or combinations of these bit 
counts provide us with all of the information we require 
to determine ring performance. 

The expert system 106 will analyze the E(i) vector 
flow from the PPVG card and send control signals to a 55 
network controller 122 A. This event vector generation 
process will be done real-time with no effect on the 
network performance. The expert system 106 uses the 
parameter counts and applies finite state machine theory 
in order to derive the desired performance measure, 60 
such as the utilization, for each link or node in a particu- 
lar network environment The expert system 106 can 
convey any analysis information, along with recom- 
mendations for the network service, to the network 
controller. The network controller 122 can use the 65 
analysis information to employ a routing algorithm to 
reallocate resources if necessary and to better under- 
stand network behavior and performance. 
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The EDI 120 may be implemented via a Field Pro- 
grammable Gate Array (FPGA) and an external Ran- 
dom Access Memory (RAM). The RAM is necessary to 
implement the tree protocol decoding algorithm. The 
programmability of the RAM or.the gate array enables 
the expert system 106 to send a new C(i) vectors to 
reconfigure the EDI 120 to accommodate different 
protocols, i.e., Token Ring, FDDI, Ethernet; and ac- 
commodate a variety of different parameter counters 
depending on the network environment The only con- 
straints to this hardware approach are the speed and 
depth of the RAM memory 132, and the number of 
gates and speed of the gate array. Due to the magnitude 
of data reduction, neither of these pose a major prob- 
lem. 

The MicroChannel Interface (MI) 138 of FIG. 8 pro- 
vides the PPVG with an interface to the PS/2 micro- 
channel (or other device) over which the PPVG 121 
receives the C(i) vector and sends the E(i) vectors. The 
Network Interface (NI) 136 provides the PPVG with 
an interface to the network. For the example of a Token 
Ring network, the PPVG passively attaches to the ring 
using the front end (FE) circuitry^ that is part of a 16 
MBPS IBM Token Ring Adapter Card. This circuitry 
locks onto the analog ring signal and converts it into a 
digital stream. The PPVG also makes use of the digital 
clock, ready signal and a frequency acquisition signal 
derived from the analog stream by the FE circuitry. 
These digital signals will be received onto the PPVG 
and fed into the EDI 120 via appropriate discrete cir- 
cuitry. The PPVG card attachment to the ring 124 is 
portrayed in FIG. IB. 

The main advantage of the PPVG hardware ap- 
proach is that it provides a real-time, passive, host-trans- 
parent way in which to monitor performance parame- 
ters. 

A Token Ring Expert System Using ICA Device Input 

This section provides a design overview of a Token 
Ring (802.5) Media Access Control (MAC) layer analy- 
sis expert system 106 designed to employ a PPVG de- 
vice 121 as the input for its analysis. We first describe 
MAC layer characteristics. Then we explain the ra- 
tional for choosing a performance analysis expert sys- 
tem to analyze the the token ring MAC layer to prove 
our ICA claims. We follow this with an overview of the 
token ring event vectors and the FSM basis of the ex- 
pert system analysis. 

Token Ring MAC Layer Characteristics 

The MAC layer controls physical ring media and any 
station operations that affect the ring. Monitoring (and 
collecting) MAC activity is necessary to determine both 
the "health" and the •'usage" of the token ring LAN. 
The ICA allows us to determine ring utilization, send 
control signals to the LAN to alter load balancing and 
routing, locate and understand errors, answer capacity 
planning issues, and in general provide any information 
required about ring activity and operation. 

The 25 MAC frame types provide all the necessary 
communication for ring management, monitoring, con- 
trol, and error recovery. In addition the MAC layer 
provides for: • - 

Address-recognition 
Frame-copying 
Frame control recognition 
Delimiting of frames 
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Frame status generation and verification 

Priority management 

Routing 

Timing 

Token management 5 

MAC Layer Challenge and Expert System Rationable 

We have discussed that data collection is a very seri- 
ous problem for all the current LAN analyzers or moni- 
tor devices on the market today. In addressing the most 10 
elementary task of ring usage, counting frames, most fail 
and we concluded any analysis must be inaccurate (es- 
pecially with heavy loads). For one reason or another, 
they cannot correctly keep up with media speed. Token 
counting was found to be even more difficult But, cor- 15 
rect frame and token counts (along with media length 
information such as ring latency) are needed to generate 
accurate ring utilization and other performance and 
control information over any arbitrary time frame. 

Monitoring token ring operation at the MAC level is 20 
considered the most challenging. This is because a 
token ring is never idle. There is constant activity with 
either token or frame circulation. In effect, the media is 
always 100% busy transmitting something. In addition, 
a significant amount of MAC layer ring management 25 
activities (such as Nearest Active Upstream Neigh- 
bor— -NAUN) occur regularly. Clearly, the correct 
capture of all MAC layer activity (along with other 
non-MAC activity) represents the most difficult data 
collection situation due to constant ring activity and the 30 
large volume of data that is likely to be generated. Re- 
porting MAC layer detected problems is relatively 
straightforward with the ICA techniques, by sending 
down a C(i) vector on line 142 to monitor for various, 
or all, types of MAC frames. Also note that perfor- 35 
mance assessment questions are considered the most 
difficult to answer. Thus, the PPVG 121 device and 
expert system 106 analysis solves the most challenging 
token ring problems under the worst case data capture 
loads. 40 

The ICA approach allows a token ring LAN to be 
successfully monitored at the MAC layer to provide all 
the information required to address performance issues 
and network control. In addition, the monitoring will be 
of such a low volume that geographic distance and data 45 
correlation problems can be easily addressed. 

ICA Events 

To understand how ICA allows information capture 
without all the problems associated with raw data cap- 50 
tore, it is necessary to understand the concept of an 
event. An "event" is the occurrence of: 

1. An arbitrary pattern of bits on the physical media. 
For example, frame and token activity can be 
counted by inspecting the T/F bit in the AC field. 55 

2. An arbitrary pattern of bits that has reoccurred 
some number of times. For example, MAC activity 
frames or some number of frames (or frame types) 
in a row. 

3. An arbitrary relationship between events as de- 60 
fined by (1) and (2) above. For example Event C is 
true (has occurred) whenever (variable * | event 
B|> (event A|) where | event i| represents the 
magnitude of event i (Le. the number of times event 

i occurred). Note this can be thought of as the 65 
volume indicator of some activity labeled event i. 
The event idea is derived from the concept that the 
activity of all protocols can be described by some finite 
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state machine pattern. The collection of one or more 
events can represent a particular state of protocol activ- 
ity over some period of time. Events can be considered 
as elementary building blocks of states. Therefore all 
states can be identified by one or more events occurring 
within a specific time period. A pattern of events which 
we call a performance vector, E(i), will be constructed 
and reported by the Variable Time Reporter. For exam- 
ple, a three event vector can provide an indication of 
one of many states occurring. 

|A|=x and |B]=y and |A| + |B|<|C| means that 
STATE P has occurred. 

|A|=y and |B| =x and |A|-j-|B| <|C| means that 
STATE Q has occurred. 

|A|=x and |B|=y and |A| + |B| >]C] means that 
STATE R has occurred. 

|A|=xand |B|=y and |A| + |B| = |C| means that 
STATE S has occurred . . . etc. 

The PPVG 121 device recognizes one or more simul- 
taneous events by using a real time bit decoding tree in 
the EDI 120. The EDI 120 will recognize any pro- 
grammed event at media speed. The incoming media bit 
stream is fed into a series storage locations in RAM 132 
which are set (via a programmed control vector C(i)) to 
recognize one or more patterns of bits. Multiple event 
counters 170 are simultaneously updated and organized 
in an output vector E(i) which is returned at the appro- 
priate frequency for one or more services. An example 
of this output vector is E(i), shown next. Where the 
value i could be a count of vectors returned. 

B0)-(|A|, |B|, |C|,...etc.) 

Event vectors could be returned to monitor ring 
activity for problem determination reasons on network 
control. For example an E(i) vector could be a series of 
counters for all MAC frame types. For example: 

E(i)=<| Beacon Count, |, J Token Claim). JTotal 
Num frames | , . . . etc.) 

The relationships between the event counts can rep- 
resent the occurrence of a specific ring problem. These 
relationships can be viewed as a "statistical signature" 
of a particular token ring problem. These signatures can 
be recognized and diagnosed by the routing expert 106. 
Appropriate network control signals can be output by 
routing expert 106 to router 115 or manager 122A in the 
network, in response. 

Token Ring MAC Expert System Vector Design 

ICA consists of two categories of vectors: Control 
vectors and Event vectors. Control vectors are desig- 
nated C(i) and event vectors are designated E(i). Two 
types of event vectors are defined. An E(0) vector and 
an E® vector where i=1^2,3. . . etc. The E(0) vector 
provides static one time information that is unlikely to 
change over time (such as the number of devices on the 
ring, ring latency, . . . etc.). The E(i) vectors provide 
variable event count information which will change 
considerably (due to changing network activity). 

The E(0 vectors for token ring MAC layer activity 
can be structured with the following event counters: 

A 30 bit number of tokens counter (#T) 

A 28 bit number of frames counter (190 F) 

A 16 bit Maximum frame size field (MAXF) in bytes 

A 16 bit Minimum frame size field (MINF) in bytes 
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A 16 bit Maximum number of frames per token rotation 
field (MFR) 

A 28 bit number of MAC frames counter (#M) 
A 16 bit Beacon counter (#B) 
A 16 bit number of reservations counter (#R) 
A 16 bit number of NOT address recognized counter 
ARbar 

A 16 bit number of NOT frame copied FC bar 
A 16 bit number of priority 4 frames counter (P4). 

The size of RAM 132 dictates the number of counters 
supported. Two example event vectors are shown next. 

E(i)=(#T,#F r MAXF>ONF,MFR49Q M, FC bar, 
AR bar,#B) 
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ECi)-(#T,#F^tAXF>{INF^FR,#M, FC 
bar,P4,#R) 

Other event vectors can be developed if required. 
The event vectors generated are a result of the "pro- 
gramming" in the C(i) vector by expert system 106. In 
addition, new events can be defined by the relationship 
between events in the same vector. For example, the 
average number of frames between tokens is simply #F 25 
divided by #T. This information can be constructed 
within the expert system 106. Other events can repre- 
sent "frequency 5 ' relationships between events. For 
(hypothetical) example, a counter increments whenever 
event A occurs three times without event B occurring. 30 

E(i) Vector Event Counters and Information 
Relationships 

Our investigations of token ring activity show there is 
a lot of useful information in ring behavior patterns. 35 
These patterns can be viewed as protocol activity signa- 
tures. Let T' be an individual token and "F w a frame. 
Let TFTTTFTT ... etc be an arbitrary string of token 
ring activity seen from a single place on the ring. We 
now present a couple of short examples to give the 40 
reader a better idea of the usefulness of the pattern 
concept Assume a ring with 10 devices. The following 
patterns can provide performance information. 



I'l'l'l'l l' . . . TTT I' — this string represents an idle ring. 
TFFFFFFFFFFT — this string represents maximum 

ring capacity for one token rotation period. 
(TFFFTFFFFFFT)n — this string represents maximum 

ring capacity for V rotations. 
TFTFTFTFTFT . . . —this string (and ones similar to 

it) most likely represents a single very busy device. 
. . . etc. 

Even more information can be obtained if the origin 
and/or destination of the frame is considered. This type 
of approach leads us to realize that event counts and 
combinations of event counts can provide us with the 
information we require to determine ring performance. 
For example, 

#T provides individual ring utilization information as 
well as an indication of device transmission opportu- 
nity. 

#T, #F provides average frame size. 
T, (#F-—#M— frame header size) provides average 
packet size. 

F, #M» MINF, and MAXF provides frame size distri- 
bution estimation information. 
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T, #F, #M, MINF, and MAXF provides a means to 
estimate arrival rate distributions. 

FPR and #R implies the presence (or absence) of 
queueing problems for devices attached to the ring 
media awaiting transmission. 

AR bar and FC bar implies buffer shortage or address- 
ing problems. 

#M and #B tells us about nonproductive activity and 

the potential for ring errors. 

Any expert system 106 derived conclusions can be 
sent to any network controller 122A or 115 via alerts or 
messages. The total ICA process can be done real-time 
with no effect on the network performance. Other pro- 
grams in memory 100 can use the event counts in con- 
junction with finite state machine theory to derive other 
desired performance measures and network control not 
included as events in the E(i) vectors (such as utiliza- 
tion). Expert system 106 can convey information, along 
with recommendations for a network service, to the 
network controller 122A or the network router 115. 
The router 115 can use the information to employ a 
routing algorithm to reallocate resources if necessary or 
to better control, monitor and understand network be- 
havior and performance. 

Token Ring Finite State Machine (FSM) 

The MAC layer token ring expert system 106 detects 
four primary states. The four primary states are: 
1. High usage state— In this case "a lot of available 
ring capacity is being utilized. One indicator may 
be that the number of available tokens per unit of 
time is low. Others could exist Two potential heu- 
ristic tests to identify the presence of this state are: 

(#F'hl)>#T 

MFR = (number of ring devices— h2) 

where hi and h2 adjust one or more of the heuristic 
tests. In the heuristics above hi is a constant multi- 
plier and h2 acts as a number of device threshold 
adjustor. 

The first heuristic could be read as: When the num- 
ber of frames exceeds the number of tokens (re- 
member tokens represent transmission opportuni- 
ties) by the amount specified by hi then routing 
expert 106 considers the ring in a high usage state. 
It could consider only non-MAC frames by sub- 
tracting #M from #F. The second heuristic could 
be read as: When the maximum number of frames 
per rotation approaches the number of devices on 
the ring, then the opportunity to transmit by one or 
more devices is likely to be delayed due to other 
device transmissions. Both heuristics could be 
"ANDed" or / ORed" in the detection of this state 
by the routing expert 106. In addition, these heuris- 
tics could be expanded by considering the number 
of reservations (#R). The hi and h2 will depend on 
some static ring characteristics such as latency, 
number of devices attached to the ring, . . . etc. 
Utilization values could be calculated from the E(i) 
event counters and utilized in conjunction with 
these heuristics. For example utilization is just: 

Util«=#T/(total tokens possible for idle ring). 

The #F, #T can lead directly to the average frame 
size and ring latency (in delay or distance). This 
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allows calculation of the total number of tokens 
possible for an idle ring. Other C(i) vectors could 
specify that ring latency be returned directly (in 
the E(0) vector, for example). 
.. Problem state — A potential problem exists when 
Beaconing, token claiming, . . . etc. is detected. 
Excessive MAC activity is considered a problem 
state indicator. To verify the existence if this state, 
the routing expert 106, can compare MAC activity 
to overall activity and total frame activity and 
construct the following heuristic. 

#M>(#F/h3) AND #F+#T>h4 AND 
#F>(#T/h5) 

The heuristic says: If routing expert 106 sees a large 
percentage of our frames are MAC frames (the first 
part of the AND) and a substantial amount of ring 
activity has occurred (the second part of the AND) 
and a significant amount of activity is from frames 
(the third part of the AND) then a Problem state 
exists. The adjusters h3 and h5 allows the determi- 
nation of what percentage of MAC frames are a 
problem. They can be looked at as a sensitivity 
adjustment Adjuster h4 is expected to be set to a 
value that prevents normal MAC activity "spikes" 
from being detected as a problem. Conclusions can 
be reached by the expert system 106 about the 
nature of the problem The expert system 106 may 
elect (if operating real time) to send down another 
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may be due to excessive broadcast activity. An 
additional heuristic test such as: 

AR bar>(#FA5) 

can be employed to detect secondary states. This 
heuristic may be employed if congestion is consid- 
ered to be occurring and a lot of the frames do not 
have address recognized set. In this case routing 
expert 106 may conclude that excessive broadcast 
activity is the cause of the congestion state. If nec- 
essary, a C(i) vector could be constructed to look 
for address bits with "broadcast settings" to con- 
firm the diagnosis. Routing and frame address field 
information could identify the source of the broad- 
casts. 

4. Optimal state— None of the other states exist. 
Other MAC Layer Applications 

Many of the event concepts described for the token 
ring (802.5) MAC expert system 106 can be directly 
applied to FDDI MAC activity. The same FSM may be 
appropriate for FDDI as well as token ring. A "generic 
ring FSM'* can be constructed for all rings with only 
the heuristic tests modified for different ring protocols. 
A FDDI expert system 106' is a straightforward and 
natural extension of our token ring expert system 106. 

Ethernet and 802.3 LANs can be analyzed and diag- 
nosed by expert 106 using the same event and FSM 



C(i) vector to tell the EDI 120 to look for particu- 30 approaches. The number of collision events along with 



lar types of MAC frames to better define the prob- 
lem. 

3. Congestion state — In this case a high usage state 
may or may not exist. In other words congestion 
could be either ring caused (e.g. a token is not 
available frequently enough) or device caused (e.g. 
internal device buffer shortage). Several potential 
heuristics to identify the presence of this state 
within the E(i) vectors can be considered. They 
are: 

(h«*#F)>#T AND FC bar>h7 AND #R>0 

MFR> (number of ring devices/h8) AND #R>0 

MFRXnumber of ring devices /h9) AND FC 
bar = (appro*. 0) 
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other events such as the number of frames transferred 
can provide load and bus availability information. Other 
events arc easily defined to provide additional informa- 
tion. Contention protocols such as Ethernet require 
fewer events to understand their behavior and thus are 
easier to analyze with the ICA approach. 

C(i) vectors from a expert system(s) can program the 
PPVG 121 hardware to look for a series of events from 
multiple protocols simultaneously (a vertical slice of the 
protocol stack). In this way, it is possible to do an analy- 
sis or a "health check" of the whole protocol stack, 
simultaneously. 
We remind the reader that with the ICA approach, 
45 the ICA hardware can be programmed to look for bit 
patterns (events) for ANY protocols being transmitted 
over the physical media. ICA is an extremely flexible, 
totally protocol independent information capture "en- 
abler." With the ICA techniques the expert system 106 
can easily look into "protocol stacks'* or recursively 
enveloped stacks to find protocol problems. 

FIG. 10 is a flow diagram of the method for the Infor- 
mation Collection Architecture invention. Step 402 
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MFR=1 AND FC bar>hl0 

where h6, h7, h8, h9 and hlO are used to adjust the 
four heuristic tests. The first two heuristic tests 
provide an indication of substantial activity and 
potential traffic delays. The last two heuristic tests 

help distinguish between ring congestion and indi- outputs from the router expert 106, a control vector C(i) 

vidual device congestion. When more devices sup- 55 to the event driven interface (EDI) 120 A. Then step 404 
port priority then reservation field information can has the routing expert 106 wait for the EDI 120A to 
be considered more meaningful. All adjusters respond. Step 406 then receives the response from the 
could be a function of LAN environmental infor- EDI 120A, which is an event vector E(i). Then step 408 
mation such as ring latency and/or the number of has the routing expert 106 compute the network perfor- 

devices on the ring and/or user input and/or static 60 mance measure. In the example previously given for the 



information returned in the E(0) vector . . . etc. The 
MFR count can be restricted to only non-MAC 
frames due to the sequential nature of some MAC 
activity. This can improve the MFR information 
usefulness as a "user" traffic load indicator. 
The ICA Finite State Machine (FSM) approach 
allows additional secondary states to be easily de- 
fined whenever required. For example, congestion 



token ring LAN 124, a high usage state can be analyzed 
by monitoring the number of frames and the number of 
tokens per unit time. When the number of frames ex- 
ceeds the number of tokens by a pre-specified amount, 
65 then the router expert 106 can consider the ring to be in 
a high usage state. Thus, the event vector E(i) will 
return the number of frames and the number of tokens 
in that time. Step 408 will then compute when the num- 
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ber of frames exceeds the number of tokens by a pre- 
specified amount Then step 410 compares the perfor- 
mance measure with the user's desired optimal or prede- 
fined performance- For example, if the user predefines 
that if the number of frames is twice the number of 
tokens then the ring is considered in a high usage state, 
then this predefined value is included in the router ex- 
pert 106. The comparison between the computed value 
and the desired value is then performed in step 410. Step 
412 has the routing expert 106 then issue a control signal 
on line 146 to the node manager 122 for the LAN 124, 
or alternately to the router 115, to change the network 
routing parameters in order to bring the token ring 
LAN 124 closer to the performance characteristics 
desired by the user. 

ICA represents a new and unique approach to pro- 
viding real-time network environment and activity in- 
formation. The ICA technique examines the character- 
istics of the communications channel in order to reduce 
to a small fraction the amount of data required to ac- 
complish real-time network functions and services. Fur- 
thermore, our technique will be applicable to all types 
of network functions and services that require lnforma- 
tion collection, not just real-time services. The main 
advantages are as follows: 

Complete "inband" programming from, and informa- 
tion (not data) returned to any network location. 

Overcomes all high speed data capture issues, geo- 
graphic distance issues, correlation issues and issues 3Q 
related to collecting environmental data. 

Provides a very cost-effective solution to the infor- 
mation capture problem. 

A primary goal of the ICA is determining the proper 
communications channel characteristics to monitor in 35 
order to maximize the information content, for a func- 
tion or service, while minimizing data collection. This 
demands the extreme monitoring flexibility that ICA 
provides. ICA is appropriate for existing networks and 
future very high speed networks. 40 

ICA information can be directly used for perfor- 
mance analysis, network control, problem determina- 
tion, and capacity planning without the need for post- 
processing, e.g., decompression or reconstruction. Fur- 
thermore, performance results derived, using the ICA 45 
technique, are at least as accurate as those obtained 
from existing performance measurement methods. 

The Information Collection Architecture invention 
can be applied to other types of systems besides digital 
data communications systems. For example, it can be 50 
applied to a body of digital data contained in the data 
base. In that application, the data base contains at least 
one unit of data which is organized under a data base 
organization scheme which has a characteristic data 
pattern which can be identified by the Event Driven 55 
Interface. A suitable control vector would be applied to 
the Event Driven Interface to filter trap and count the 
characteristic pattern of the data unit desired to be 
counted. Counting such data units can then be used to 
characterize the overall organization of the data base. 

Although a specific embodiment of the invention has 
been disclosed, it will be understood by those having 
skill in the art that changes can be made to that specific 
embodiment without departing from the spirit and the 
scope of the invention. 

What is claimed is: 

1. A method for information collection for a body of 
data, comprising the steps of: 
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setting up a programmable vector generator with 

parameters characterizing the environment for the 

body of data in a vector C(i); 
performing real-time identification of event behavior 

in the environment for the body of data using the 

vector C(i); 

characterizing the event behavior for the identified 
events in a vector ECO; 

performing an analysis of the event behavior for the 
body of data in die vector E(i); 

automatically generating control signals from the 
analysis; and outputting the control signals to mod- 
ify the behavior of the body of data. 

2. The method of claim 1 wherein said body of data is 
a data communications network which operates under 
at least one protocol and communicates data over the 
network. 

3. The method of claim 1 wherein said body of data is 
a data base containing at least one unit of data which is 
organized under a data base organization scheme. 

4. The method of claim 1 wherein said body of data is 
a communications medium which operates under at 
least one protocol and communicates over the medium. 

5. An Information Collection Architecture System 
for characterizing a communications network, compris- 
ing: 

a storage means for storing setup data; 

a programmable vector generator coupled to said 
storage means, for receiving the setup data which 
characterizes the environment of said communica- 
tions network in a vector C®; 

said programmable vector generator being coupled 
to said communications network for receiving sig- 
nals therefrom; 

said programmable vector generator using the vector 
C(i) and performing real time identification of 
events in the environment as represented by said 
signals received from said network; 

said programmable vector generator characterizing 
said identified events in a vector E(i) indicative of 
the behavior of the network; 

an analyzer coupled to said programmable vector 
generator, for performing an analysis of said identi- 
fied events in the vector E© for said network; and 

a control signal generator coupled to said program- 
mable vector generator, for automatically output- 
ting control signals to said communications net- 
work, for modifying the behavior of said network, 
in response to said analysis by said analyzer. 

6. A method for Information Collection in a data 
communications network which operates under at least 
one protocol and communicates data over the network, 
comprising the steps of: 

outputting a control vector C(i) to an Event Driven 
Interface coupled to the data communications net- 
work, the vector specifying network monitoring 
information including data patterns; 

counting data patterns specified by said 1 control vec- 
tor in real time using the Event Driven Interface; 

receiving an event vector E(i) from said Event 
Driven Interface which includes counts of a num- 
ber of said pre-specified data patterns occurring in 
said data communications network; 

computing a network performance measure from said 
event vector; 

comparing said performance measure with a prede- 
fined network performance characteristic; and 
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automatically outputting a control signal to a net- 
work control device coupled to said data commu- 
nications network, to modify the operating charac- 
teristics of said data communications network in 
response to said comparison step. 

7. A system for controlling a communications net- 
work which communicates a serial stream of binary bits 
having a characteristic data pattern, comprising: 

a control vector generator, for generating a control 
vector C(i) which describes said characteristic data 
pattern; 

an Event Driven Interface coupled to said network 
and to said control vector generator, having an 
addressable memory with a plurality of data stor- 
age locations including stored data, for receiving 
said control vector to configure data stored in said 
data storage locations to represent a digital filter 
for said data pattern; 

said control vector generator outputting said control ^ 
vector to said Event Driven Interface coupled to 
configure said Event Driven Interface to digitally 
filter said characteristic pattern in real time and 
increment a counter coupled thereto, to generate 
an event vector E(i); and 

an event vector analyzer coupled to said Event 
Driven Interface, for analyzing said event vector 
E(i) which represents a plurality of occurrences of 
said pattern on said network and automatically 
generating control signals to modify the network. 

8. The system of claim 7, wherein said Event Driven 
Interface further comprises: 

an n-bit address register having a first portion with 
n-l-bits and a second portion with one bit and an 
input to said second portion coupled to said net- 
work, for receiving a bit from said serial bit stream; 

an addressable memory having a plurality of data 
storage locations, each having a first portion with 
n-1 bits and a second portion with m bits, said mem- 
ory having an n-bit address input coupled an output 40 
of said address register and having a data input 
coupled to said control vector generator, for re- 
ceiving said control vector to configure data stored 
in first and second ones of said data storage loca- 
tions to represent a digital filter for said pattern; 

a feedback path from an output of said memory to an 
input of said register, for transferring said data 
from said first portion of said first one of said data 
storage locations in said memory to said first por- 
tion of said address register, for concatenation with 
said bit from said serial bit stream to form an ad- 
dress for said second one of said data storage loca- 
tions of said memory; and 

a counter coupled to an output of said memory and 
coupled to said event vector analyzer, for counting 
at least one bit in said data output from said second 
portion of said second one of said data storage 
locations in said memory, forming said event vec- 
tor which is output to said event vector analyzer. 

9. The system of claim 7, wherein said event vector 
analyzer further comprises: 

a data processor coupled to said network and coupled 
to said Event Driven Interface to receive said 
event vector, for executing programs of executable 65 
instructions to analyze said event vector and out- 
putting control signals in response thereto to said 
network; 



an expert system program of executable instructions 
coupled to said data processor for execution 
therein, for comparing said event vector with in- 
formation representing predefined behavior for 
said network and analyzing said event vector with 
a knowledge base of information to generate con- 
trol signals to control said network in response to 
said event vector; and a network controller cou- 
pled to said expert system and to said network, for 
receiving control signals from said data processor 
in response to said analysis of said event vector by 
said expert system, to adjust the behavior of said 
network. 

10. The system of claim 9, wherein said data commu- 
nications network is a token ring network. 

11. The system of claim 9, wherein said data commu- 
nications network is a FDDI network. 

12. The system of claim 9, wherein said data commu- 
nications network is a Ethernet network. 

13. The system of claim 9, wherein said data commu- 
nications network is a SNA network. 

14. The system of claim 9, wherein said data commu- 
nications network is a TCP IP network. 

15. The system of claim 9, wherein said data commu- 
nications network is a SONET network. 

16. The system of claim 9, wherein said data commu- 
nications network is a ATM network. 

17. A method for controlling a data communications 
network which communicates a serial stream of binary 

30 bits having a characteristic pattern, comprising the steps 
of: 

generating a control vector C(i) which describes said 
characteristic pattern, in a control vector generator 
coupled to an Event Driven Interface; 
outputting said control vector from said control vec- 
tor generator to said Event Driven Interface which 
is coupled to said network; 
configuring said Event Driven Interfae using said 

control vector; 
digitally filtering said characteristic pattern with said 

Event Driven Interface in real time; 
incrementing a counter coupled to said Event Driven 
Interface, to generate an event vector in response 
to filtering said characteristic pattern; 
outputting said event vector from said Event Driven 
Interface to an event vector analyzer coupled 
thereto; 

analyzing said event vector E(i) which represents a 
plurality of occurrences of said pattern on said 
network, in said event analyzer, and 
automatically outputting control signals from said 
event analyzer to said network to control said net- 
work in response to said event vector. 

18. The method of claim 17, wherein said data com- 
munications network is a token ring network. 

19. The method of claim 17, wherein said data com- 
munications network is a FDDI network. 

20. The method of claim 17, wherein said data com- 
munications network is a Ethernet network. 

21. The method of claim 17, wherein said data com- 
munications network is a SNA network. 

22. The method of claim 17, wherein said data com- 
munications network is a TCP IP network. 

23. The method of claim 17, wherein said data com- 
munications network is a SONET network. 

24. The method of claim 17, wherein said data com- 
munications network is a ATM network. 

***** 



35 



45 



50 



55 



60 



01/12/2004, EAST version: 1.4.1 



